Block unauthorized Read, Bash, Grep, and Glob calls targeting .env files.
npx skills add https://github.com/zcaceres/skills --skill safety-dotenv-guard
Please help me install this Agent Skill. Skill: safety-dotenv-guard Source: https://github.com/zcaceres/skills/tree/main/skills/safety-dotenv-guard Command: npx skills add https://github.com/zcaceres/skills --skill safety-dotenv-guard
This skill prevents accidental exposure of sensitive environment variables by intercepting and blocking unauthorized attempts to read or manipulate .env files within the Claude Code environment.
Run the install script from the skill directory to wire the security hook into your Claude Code settings for always-on protection.
High-intent search queries and answers about installing and using this skill.
This security hook intercepts Read, Bash, Grep, and Glob tool calls in Claude Code, blocking unauthorized access to .env files to prevent production secrets from entering the agent's context.
Yes, standard template files like .env.example and .env.template are explicitly allowlisted, ensuring standard development workflows remain uninterrupted while blocking actual secret files.
Yes, the defense-in-depth mechanism validates file paths and command arguments against a strict blocklist, catching direct file access, subshell bypass attempts, and wildcard expansion tricks.
You need the jq dependency installed on your system. Run the provided install script from the skill directory to wire the PreToolUse security hook into your Claude Code settings for always-on protection.
Environment variables leak when standard tool calls read .env files directly. Intercepting these tool calls with a strict blocklist prevents sensitive production secrets from entering the agent's context.
officechbusinessservices-creatorBlock dangerous git commands in Claude Code via a PreToolUse hook.
EvaLokDocuments Bash command permissions and blocked constructs for orchestrator workflows.
tan-yong-shengIdentify and isolate root causes of bugs through a four-phase workflow.
emiljuchnikowskiBlock destructive bash commands and sensitive file access in automated workflows.
